CVE-2006-4997: canonical ubuntu_linux Use After Free

Modified

Published 09-10-2006Last modified 07-08-2024

Vulnerability summary

CVE-2006-4997 is a high (CVSS 7.5) Use After Free vulnerability in canonical ubuntu_linux. EPSS estimates a 4.87% chance of exploitation in the next 30 days, higher than 92% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Prioritisepublic exploit

Public exploit (reference, Date unknown)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (NVD)

EPSS score

4.87%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 8

DSA-1233 DSA-1233-1 DSA-1237 DSA-1237-1 RHSA-2006:0689 RHSA-2006:0710+2 more

Timeline

09-10-2006
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

The clip_mkip function in net/atm/clip.c of the ATM subsystem in Linux kernel allows remote attackers to cause a denial of service (panic) via unknown vectors that cause the ATM subsystem to access the memory of socket buffers after they are freed (freed pointer dereference).

CVSS metrics

2 scores · 1 source · 2 versions

v3.17.5v2.07.1

EPSS trend

Probability

4.87%

Chance of exploitation in the next 30 days

Percentile

92%

Versus all other CVEs

30-day change

No change 0.00 pp

From 4.87% on 05-10-2026

05-10-202604-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

referenceUnverified
Exploit Reference (bugzilla.redhat.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Canonical1 product

ubuntu_linuxEOL5.10 | 6.06 | 6.10

Linux1 product

linux_kernel< 2.6.18

Redhat1 product

enterprise_linuxEOL2.1 | 3 | 4

3 vendors · 3 products

References

38 links

bugzilla.redhat.com/bugzilla/show_bug.cgi?id=206265X Refsource CONFIRMExploitIssue Tracking
www.securityfocus.com/bid/20363VDB EntryX Refsource BIDBroken LinkThird Party Advisory
www.mandriva.com/security/advisories?name=MDKSA-2007:025Vendor AdvisoryX Refsource MANDRIVABroken Link
www.novell.com/linux/security/advisories/2006_79_kernel.htmlVendor AdvisoryX Refsource SUSEBroken Link
secunia.com/advisories/22253Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
www.redhat.com/support/errata/RHSA-2007-0012.htmlVendor AdvisoryX Refsource REDHATBroken Link
secunia.com/advisories/22279Third Party AdvisoryX Refsource SECUNIABroken LinkPatchVendor Advisory
secunia.com/advisories/23788Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/22292Third Party AdvisoryX Refsource SECUNIABroken LinkPatchVendor Advisory
www.redhat.com/support/errata/RHSA-2007-0013.htmlVendor AdvisoryX Refsource REDHATBroken Link

Show all 38 references

www.redhat.com/support/errata/RHSA-2006-0689.htmlVendor AdvisoryX Refsource REDHATBroken LinkPatch
www.mandriva.com/security/advisories?name=MDKSA-2007:012Vendor AdvisoryX Refsource MANDRIVABroken Link
securitytracker.com/id?1017526VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
secunia.com/advisories/23384Third Party AdvisoryX Refsource SECUNIABroken Link
www.kernel.org/gitX Refsource CONFIRMBroken Link
secunia.com/advisories/23752Third Party AdvisoryX Refsource SECUNIABroken Link
www.us.debian.org/security/2006/dsa-1237Vendor AdvisoryX Refsource DEBIANBroken Link
secunia.com/advisories/22762Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/24288Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/23474Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/23064Third Party AdvisoryX Refsource SECUNIABroken Link
www.us.debian.org/security/2006/dsa-1233Vendor AdvisoryX Refsource DEBIANBroken Link
secunia.com/advisories/23370Third Party AdvisoryX Refsource SECUNIABroken Link
support.avaya.com/elmodocs2/security/ASA-2006-249.htmX Refsource CONFIRMThird Party Advisory
www.vupen.com/english/advisories/2006/3999VDB EntryX Refsource VUPENBroken Link
support.avaya.com/elmodocs2/security/ASA-2007-078.htmX Refsource CONFIRMThird Party Advisory
www.securityfocus.com/archive/1/471457Mailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
support.avaya.com/elmodocs2/security/ASA-2006-254.htmX Refsource CONFIRMThird Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10388VDB EntrySignatureX Refsource OVALBroken Link
secunia.com/advisories/22497Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/22945Third Party AdvisoryX Refsource SECUNIABroken Link
www.redhat.com/support/errata/RHSA-2006-0710.htmlVendor AdvisoryX Refsource REDHATBroken Link
www.ubuntu.com/usn/usn-395-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.vupen.com/english/advisories/2006/3937VDB EntryX Refsource VUPENBroken Link
www.mandriva.com/security/advisories?name=MDKSA-2006:197Vendor AdvisoryX Refsource MANDRIVABroken Link
secunia.com/advisories/23395Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/25691Third Party AdvisoryX Refsource SECUNIABroken Link
exchange.xforce.ibmcloud.com/vulnerabilities/29387VDB EntryX Refsource XFThird Party Advisory